fix(scap): fix scap-file support

Signed-off-by: Andrea Terzolo <[email protected]>

userspace/libscap/engine/savefile/scap_savefile.c

@@ -119,11 +119,11 @@ static int32_t scap_read_proclist(scap_reader_t* r, uint32_t block_length, uint3
 		tinfo.cap_permitted = 0;
 		tinfo.cap_effective = 0;
 		tinfo.exe_upper_layer = false;
-		tinfo.exe_lower_layer = false;
 		tinfo.exe_ino = 0;
 		tinfo.exe_ino_ctime = 0;
 		tinfo.exe_ino_mtime = 0;
 		tinfo.exe_from_memfd = false;
+		tinfo.exe_lower_layer = false;
 
 		//
 		// len
@@ -684,14 +684,6 @@ static int32_t scap_read_proclist(scap_reader_t* r, uint32_t block_length, uint3
 			subreadsize += readsize;
 		}
 
-		// exe_lower_layer
-		if(sub_len && (subreadsize + sizeof(uint8_t)) <= sub_len)
-		{
-			readsize = r->read(r, &(tinfo.exe_lower_layer), sizeof(uint8_t));
-			CHECK_READ_SIZE_ERR(readsize, sizeof(uint8_t), error);
-			subreadsize += readsize;
-		}
-
 		// exe_ino
 		if(sub_len && (subreadsize + sizeof(uint64_t)) <= sub_len)
 		{
@@ -726,6 +718,14 @@ static int32_t scap_read_proclist(scap_reader_t* r, uint32_t block_length, uint3
 			tinfo.exe_from_memfd = (exe_from_memfd != 0);
 		}
 
+		// exe_lower_layer
+		if(sub_len && (subreadsize + sizeof(uint8_t)) <= sub_len)
+		{
+			readsize = r->read(r, &(tinfo.exe_lower_layer), sizeof(uint8_t));
+			CHECK_READ_SIZE_ERR(readsize, sizeof(uint8_t), error);
+			subreadsize += readsize;
+		}
+
 		//
 		// All parsed. Add the entry to the table, or fire the notification callback
 		//

userspace/libscap/scap_savefile.c

@@ -651,11 +651,11 @@ int32_t scap_write_proclist_entry_bufs(scap_dumper_t *d, struct scap_threadinfo
 			  sizeof(uint64_t) + // cap_permitted
 			  sizeof(uint64_t) + // cap_effective
 			  sizeof(uint8_t) + // exe_upper_layer
-			  sizeof(uint8_t) + // exe_lower_layer
 			  sizeof(uint64_t) + // exe_ino
 			  sizeof(uint64_t) + // exe_ino_ctime
 			  sizeof(uint64_t) + // exe_ino_mtime
-			  sizeof(uint8_t)); // exe_from_memfd
+			  sizeof(uint8_t) + // exe_from_memfd
+			  sizeof(uint8_t)); // exe_lower_layer
 
 	if(scap_dump_write(d, len, sizeof(uint32_t)) != sizeof(uint32_t) ||
 		    scap_dump_write(d, &(tinfo->tid), sizeof(uint64_t)) != sizeof(uint64_t) ||
@@ -698,11 +698,11 @@ int32_t scap_write_proclist_entry_bufs(scap_dumper_t *d, struct scap_threadinfo
 			scap_dump_write(d, &(tinfo->cap_permitted), sizeof(uint64_t)) != sizeof(uint64_t) ||
 			scap_dump_write(d, &(tinfo->cap_effective), sizeof(uint64_t)) != sizeof(uint64_t) || 
 			scap_dump_write(d, &(tinfo->exe_upper_layer), sizeof(uint8_t)) != sizeof(uint8_t) ||
-			scap_dump_write(d, &(tinfo->exe_lower_layer), sizeof(uint8_t)) != sizeof(uint8_t) ||
 			scap_dump_write(d, &(tinfo->exe_ino), sizeof(uint64_t)) != sizeof(uint64_t) ||
 			scap_dump_write(d, &(tinfo->exe_ino_ctime), sizeof(uint64_t)) != sizeof(uint64_t) ||
 			scap_dump_write(d, &(tinfo->exe_ino_mtime), sizeof(uint64_t)) != sizeof(uint64_t) ||
-			scap_dump_write(d, &(tinfo->exe_from_memfd), sizeof(uint8_t)) != sizeof(uint8_t))
+			scap_dump_write(d, &(tinfo->exe_from_memfd), sizeof(uint8_t)) != sizeof(uint8_t) ||
+			scap_dump_write(d, &(tinfo->exe_lower_layer), sizeof(uint8_t)) != sizeof(uint8_t))
 	{
 		snprintf(d->m_lasterr, SCAP_LASTERR_SIZE, "error writing to file (2)");
 		return SCAP_FAILURE;